drspacemonkey

I'm currently building a side project I'd like to release for public use at some point, and I'm using PGP/RSA (soon-to-be ECDSA pending some cross-platform experimentation) for multiple-recipient encrypted messages. What makes ECDSA such a foot-cannon?

Caveat: I know enough about encryption to never roll my own.

It also used to be considered paranoia to think that the NSA might do all the things in the Snowden leaks, but here we are.

The problem is that Google wants to give the military better weapons to kill people, knowing full well that they're intended to be better at killing people, and they're using the data we voluntarily gave them under the illusion that they wouldn't do evil things with it.

Evil things like making better weapons for people who kill innocent civilians.

I've seen Ben Crystal do some other Original Pronunciation Shakespeare videos. It's his specialty, and I would love to see one of his "original practice" productions live one day.

Here's a couple more of his videos:

https://www.youtube.com/watch?v=gPlpphT7n9s

https://www.youtube.com/watch?v=qYiYd9RcK5M

We've already got users who fall under GDPR protection. Not as many as we will by the end of this year, but some.

And really, I've done all I can do. I've talked it up, given powerpoint presentations, and emailed a comprehensive report about penalties for failing to comply as well as a project outline for becoming compliant.

We're in fintech. And we're not in Europe, but we're about to start a big project targeted towards European users.

Right now, it's not. Management has decided that we're going to keep operating the way we have been as if the GDPR didn't exist, and hope nobody notices. Which isn't a surprise, this company is very reactive. Proactive planning doesn't happen.

>Nothing has been learned

In my limited view, this is pretty much the case. When I was telling our management team about the GDPR and how it relates to our new European-focused project, the first thing the CEO said was "how do we get around this?"

Management decided we're not gonna comply with the GDPR and just hope nobody notices.

Agreed. There's nothing more exciting in science than finding out that our widely-held beliefs about something are wrong.

True, but the number of executives and managers that are just starting to ask "what's this GDPR thing I keep hearing about?" tells me that it's about to be a growth industry.

IME, there's also a significant overlap between the execs that insist "2 years isn't enough time to get compliant" and execs that ignored it for the last 2 years. Not sure what that means, but it's at the point where I write off timeline complaints as whining and lack of forethought.

Yes. A friend of mine is very much an uninvolved father. His wife handles all the child-rearing and housekeeping, while he plays videogames, often while drinking. I've mentioned to him that he should probably be more involved, but it's not my place or responsibility to tell him he's failing as a husband and father. In his defence, he's still a better father than his own father ever was, but that's not exactly a high bar, and he knows it.

Frankly, I don't know why his wife puts up with him.

38yo Canadian male. Made a conscious decision to never have kids when I was 30. Haven't changed my mind.

Hell, it's even worse than that. "Sex tape" implies Hogan and a ladyfriend set up a camera and put on a show.

They were recorded having sex via hidden camera, without their knowledge or consent. That's a sex crime that they treated like it was leaked nude selfies.

The more difficult part is deletion from backups, which is also a requirement.

IMO, the best solution is per-row encryption with the keys stored in a second database. This second database can still be backed up, with backups that have a maximum lifespan, eg: 30 days. When a user deletes their account, their decryption key is deleted, and is unrecoverable after the backup max life.

Honestly, I don't know. That's not my field of expertise. I'm mostly just cynical about fines and penalties being paraded around as a curative measure, only to find out that the fines and penalties have such huge loopholes that entire corporations can fit through.

If I were a gambling man, I'd bet that would just lead to "data warehouse" subsidiaries that would hold the liability. In case of a leak, they'd "go broke", and another would be spun up in its place. Same thing is happening with temp agencies to shield employers from workplace injury liability.

http://projects.thestar.com/temp-employment-agencies/

I completely agree with you. Shit security should cost money. I just think it has to be something like data leak liability insurance. The costs of having shitty security would be reflected in higher insurance premiums. That way, financial math would be firmly on the side of keeping data secure, instead of limiting exposure via corporate shell games.

The ability to create and share a netflix playlist, effectively user-created "TV networks", would be absolutely awesome. Most would be crap, but the same can be said for youtube playlists.

>Normally the way this is done they don't supply the content from the original game you have to provide your own copy which you then mod to use the newer version of the engine

Hell, this is exactly how the Tale of Two Wastelands mod gets the Fallout 3 content into New Vegas. It's not a seamless process, but it's really good. I have to admit, I'm quite saddened by this turn of events.

I wonder if that could be resolved by the government offering an annual bonus for every road that requires no pothole maintenance. If the bonus were bigger than the profit they'd make from filling in the pothole, it would be free money for the contractor + a savings for the government because they don't have to pay to fix something that isn't broken.

Mostly, I wonder how different the world would be if there was an incentive to build things that don't break.

I've never been hit by it personally, but I know two people from different companies that found themselves in the same situation.

The first went through the stages of grief, and "acceptance" meant shutting down. The second company had the option to pivot and focus on a specific feature that AWS lacked, but the company decided against that plan. According to my friend over there, management is still in denial over the severity of the threat. He's looking for other work, and so are most of his co-workers.

Unfortunately, this is not good news. On the plus side, you're cognisant of what you're facing, which means you can start looking for ways to pivot. Failing that, you can decide to bail before things become critical.

I'm really sorry to hear you're in this situation. For what it's worth, you're in good company.

It's much easier to convince people that tests are necessary if you're starting a new project. Problems arise when you're working on a legacy codebase that never had tests to begin with. Often, the code isn't testable at all.

IME, there are far too many "senior" devs (who absolutely should know better) who never worked on any testing-heavy teams that just don't see the point. After all, there's QA, and it's not like THIS code should break THAT code in a seemingly-unrelated part of the codebase...

Maybe it's just me, but this reads like an attempt to say they recently received another national security letter.

Generally, they're making things worse. After finally getting around to dealing with doctors over-prescribing powerful opioids, they just shut down the legal supply. Now all those patients, many of whom are addicted because they've been taking chewable heroin for months or years, have to kick one of the toughest addictions known to medical science. On top of that, they're back to dealing with the back/knee/etc pain that caused them to start taking opioids in the first place.

It's no surprise that many of them simply can't do it, and thus turn to a VERY thriving black market.

The DEA gets involved again, and now those people hooked on pain meds given to them by their doctor are in the legal cross-hairs because they're buying the same shit from somebody who illegally imported it from Mexico or China.

This is not a new problem in America. It's been an issue in the past. First it was morphine after the civil war, then it was Bayer-brand Heroin (which was marketed as a non-addictive morphine substitute) after WW1. Every time somebody gets the bright idea to restrict an opioid because of how many addicts it creates, they never seem to have an answer to the follow-up question - what do we do with the addicts? Then we are collectively shocked about the size of the black market afterwards.

>I hope you're right and it's not the other way around.

Sadly, it is the other way around. Purdue spent millions of dollars advertising Oxycontin as a safe, less-addictive painkiller for chronic pain. Doctors were inundated with "FDA-approved" marketing info, telling them that this specific kind of heroin was an easy, twice-per-day way to deal with back problems, knee pain, arthritis, etc. It was so deceptive that three of their executives were found guilty of criminal charges, and the company was hit with a fine so high it was a record in the pharmaceutical industry.

After people had been prescribed what is effectively heroin on a regular basis for months or years, they were addicted.

The government argues that searches at international borders is a "reasonable" search, thus the 4th amendment's prohibition on "unreasonable searches and seizures" doesn't apply.

The EFF disagrees. You can read their reasoning in the linked article.

That hasn't applied at or within 100 miles of a US border point of entry since 1953.

About 2 years ago, I was in the same position as you. Had been freelancing for years, then went back to full-time employment. It was quite a change from what I was used to. IE: working with a very small team of people I chose and have worked with before.

A lot of the advice I've seen here relies on the rest of the team wanting things to get better. That's not always the case. Many teams are very proud of their unmaintanable, untestable spaghetti. Some see it as a of badge of honour that nobody else can figure out something as basic as where model validation happens (in that specific case, they marshalled all their model validation into the controller parent class, and things got worse from there).

So the first thing you need to do is figure out how open they are to changing. If they're happy with what they've got, and they don't want to change how they write code, then there's not much you can do. Cleaning as you go is a great idea. But even if there's only one other person on the team and and they don't want to change anything, they'll be generating mess twice as fast as you can clean (making a mess is always faster than cleaning).

That's my advice. Try to probe if they're willing to admit they even have a problem. Start with floating the idea of writing tests, or implementing a style guide. If they don't even want to do that, there's no way you're gonna get anything bigger out of them. At that point, you gotta decide if this job is right for you.

>Isn't that like a turkey asking why they haven't been slaughtered yet? Then the day before Thanksgiving comes and times up.

This is an excellent way to illustrate so many problems of this nature. "If X is a real concern, why hasn't it happened to us yet?" is such a huge problem in so many organisations, and it's so frustrating.

Having used a TENS system before, yes. And if there's imperfect contact, it stings like a bastard.

I was under the impression that kuru was a prion disease that comes from eating brain matter. Was I wrong about that?